cpio/patches/cpio-2.13-revert-CVE-2015-1197-fix.patch

revert fix for CVE-2015-1197 as it causes shutdown issues

revert suggested as a workaround by upstream:
https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html

--- b/src/copyin.c
+++ a/src/copyin.c
@@ -645,14 +645,13 @@
       link_name = xstrdup (file_hdr->c_tar_linkname);
     }
 
-  cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false);
-  
   res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
 			 file_hdr->c_mode);
   if (res < 0 && create_dir_flag)
     {
       create_all_directories (file_hdr->c_name);
+      res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
+			     file_hdr->c_mode);
-      res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode);
     }
   if (res < 0)
     {
--- b/tests/CVE-2015-1197.at
+++ /dev/null
@@ -1,43 +0,0 @@
-# Process this file with autom4te to create testsuite.  -*- Autotest -*-
-# Copyright (C) 2009-2019 Free Software Foundation, Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3, or (at your option)
-# any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)])
-AT_CHECK([
-tempdir=$(pwd)/tmp
-mkdir $tempdir
-touch $tempdir/file
-ln -s $tempdir dir
-AT_DATA([filelist],
-[dir
-dir/file
-])
-ln -s /tmp dir
-touch /tmp/file
-cpio -o < filelist > test.cpio
-rm dir /tmp/file
-cpio --no-absolute-filenames -iv < test.cpio
-],
-[2],
-[],
-[1 block
-cpio: Removing leading `/' from hard link targets
-dir
-cpio: dir/file: Cannot open: No such file or directory
-dir/file
-1 block
-])
-AT_CLEANUP
-
--- b/tests/Makefile.am
+++ a/tests/Makefile.am
@@ -56,9 +56,8 @@
  symlink-long.at\
  symlink-to-stdout.at\
  version.at\
  big-block-size.at\
- CVE-2015-1197.at\
  CVE-2019-14866.at
 
 TESTSUITE = $(srcdir)/testsuite

--- b/tests/testsuite.at
+++ a/tests/testsuite.at
@@ -43,6 +43,5 @@
 m4_include([setstat04.at])
 m4_include([setstat05.at])
 m4_include([big-block-size.at])

-m4_include([CVE-2015-1197.at])
 m4_include([CVE-2019-14866.at])
1	revert fix for CVE-2015-1197 as it causes shutdown issues
2
3	revert suggested as a workaround by upstream:
4	https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html
5
6	--- b/src/copyin.c
7	+++ a/src/copyin.c
8	@@ -645,14 +645,13 @@
9	link_name = xstrdup (file_hdr->c_tar_linkname);
10	}
11
12	- cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false);
13	-
14	res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
15	file_hdr->c_mode);
16	if (res < 0 && create_dir_flag)
17	{
18	create_all_directories (file_hdr->c_name);
19	+ res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
20	+ file_hdr->c_mode);
21	- res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode);
22	}
23	if (res < 0)
24	{
25	--- b/tests/CVE-2015-1197.at
26	+++ /dev/null
27	@@ -1,43 +0,0 @@
28	-# Process this file with autom4te to create testsuite. -- Autotest --
29	-# Copyright (C) 2009-2019 Free Software Foundation, Inc.
30	-#
31	-# This program is free software; you can redistribute it and/or modify
32	-# it under the terms of the GNU General Public License as published by
33	-# the Free Software Foundation; either version 3, or (at your option)
34	-# any later version.
35	-#
36	-# This program is distributed in the hope that it will be useful,
37	-# but WITHOUT ANY WARRANTY; without even the implied warranty of
38	-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
39	-# GNU General Public License for more details.
40	-#
41	-# You should have received a copy of the GNU General Public License
42	-# along with this program. If not, see <http://www.gnu.org/licenses/>.
43	-
44	-AT_SETUP([CVE-2015-1197 (--no-absolute-filenames for symlinks)])
45	-AT_CHECK([
46	-tempdir=$(pwd)/tmp
47	-mkdir $tempdir
48	-touch $tempdir/file
49	-ln -s $tempdir dir
50	-AT_DATA([filelist],
51	-[dir
52	-dir/file
53	-])
54	-ln -s /tmp dir
55	-touch /tmp/file
56	-cpio -o < filelist > test.cpio
57	-rm dir /tmp/file
58	-cpio --no-absolute-filenames -iv < test.cpio
59	-],
60	-[2],
61	-[],
62	-[1 block
63	-cpio: Removing leading `/' from hard link targets
64	-dir
65	-cpio: dir/file: Cannot open: No such file or directory
66	-dir/file
67	-1 block
68	-])
69	-AT_CLEANUP
70	-
71	--- b/tests/Makefile.am
72	+++ a/tests/Makefile.am
73	@@ -56,9 +56,8 @@
74	symlink-long.at\
75	symlink-to-stdout.at\
76	version.at\
77	big-block-size.at\
78	- CVE-2015-1197.at\
79	CVE-2019-14866.at
80
81	TESTSUITE = $(srcdir)/testsuite
82
83	--- b/tests/testsuite.at
84	+++ a/tests/testsuite.at
85	@@ -43,6 +43,5 @@
86	m4_include([setstat04.at])
87	m4_include([setstat05.at])
88	m4_include([big-block-size.at])
89
90	-m4_include([CVE-2015-1197.at])
91	m4_include([CVE-2019-14866.at])